13 ms·

Code.mil – An experiment in open source at the Department of Defense

378 points by us0r 10y ago

kogus 10y ago
I have never worked on code intended for military use. From my layman's point of view, it seems like DoD code would either be "the most boring legacy CMS you can imagine" or "top secret missile guidance AI systems". The former isn't interesting. The latter should probably stay closed-source. Is there any DoD code that is both interesting and suitable for public consumption?
- detaro 10y ago
  Infrastructure stuff? e.g. SELinux was created by the NSA.
- krylon 10y ago
  NB I have no first-hand knowledge, hence being deliberately vague. But I remember reading about a statement from the Pentagon that they recouped every cent they ever invested in computer science research during Operation Desert Storm, thanks to a logistics package that had grown out of said research. And given the scope of the US military apparatus, it does not sound ridiculous. Now, this is like 4th-level hearsay, but I can imagine such a logistics package would be quite interesting for many a company.
- astine 10y ago
  I don't work on any DoD stuff myself, but folks I know have developed ad-hoc networking capabilities that are mainly useful for helping military units communicate but likely have other applications.
- jcurbo 10y ago
  It is surprising to people outside the DoD, but most applications are exceedingly mundane - I would lump a lot of them under "database frontends," like personnel, finance, and logistics systems. One problem there is that, in many cases, DoD or its contractors end up writing custom code for those things rather than using existing solutions, so projects get delayed as feature creep sets in. There is a bigger push for using commodity software but it's slow in coming. For things where you truly need custom code - like missile guidance systems, avionics, specific process oriented tools for crunching data (intel or otherwise), open sourcing the core application is probably not going to help anyway. One problem though is that, increasingly, people want to use open source libraries for things. Take the data crunching - people want to use R, Python, Hadoop, whatever. This is where people are running into issues. And good luck getting those tools into close environments (e.g. classified networks) - many places do not have the resources in manpower or expertise to custom build the environments they need, so they couldn't use the newest shiny stuff even if they wanted to, even if their IA shop allowed it. As to your last question, not a lot of examples to mind (maybe Accumulo like someone mentioned elsewhere), but another factor is that there are few programmers that are actually DoD civil servants - most stuff is written by contractors and DoD folks don't usually have the experience or knowledge necessary to even understand what they're getting at a technical level in order to recognize that what they have is something worth open sourcing (which might take some work). I'm not saying it's bad everywhere - I have met some pretty awesome technical folks that were GS's - but it's very uneven. (disclaimer: USAF vet and still involved with the DoD)
ryanmaynard 10y ago
It appears some of the 18F crew are behind this. I'm interested to see what unfolds in this repo.
- dkhenry 10y ago
  Actually it would appear to be the Defense Digital Service https://www.dds.mil/ The contact in the license points to a dds.mil address
  - ryanmaynard 10y ago
    Forgive my ignorance. I thought 18F and Digital Services were interlinked.
    - konklone 10y ago
      I'm from 18F, and I'm now a "contributor", but only because they accepted my pull requests. :)
    - webmaven 10y ago
      The Defense Digital Service and the US Digital Service are distinct organizations: http://www.defenseone.com/technology/2015/11/meet-head-pentagons-agile-new-digital-service/123825/ http://www.defenseone.com/technology/2015/11/meet-head-penta...
    - Readywater 10y ago
      DDS spun out of US Digital Service and DDS members go through the USDS hiring pipeline. 18F, USDS, and the Presidential Innovation Fellowships are philosophically related, but organizationally and functionally distinct.
dkhenry 10y ago
I love seeing this kind of work done. Not because its going to radically change the underlying technology, but having the air cover a project like this will provide can enable so many government coders who get shut down by their first tier manager who tells them they can't use open source components or can't open source their code. Its might seem silly but just getting the projects out in the open increases their hygiene more then any other single factor.
- michaelvoz 10y ago
  I hate the word coders. Lets stop using it
  - qz_ 10y ago
    Why? It's pretty descriptive.
    - cooper12 10y ago
      Personally, and I'd like to stress that this is my opinion, I feel that the term is very reductive. It has its etymology in "code", when programming encompasses much more than just writing code. (we also write documentation, tests, use complex tools, version control, invoke the command line, etc...) It evokes the term "code monkey" which just sees programmers as tools to barf out code. Lastly this is just my own conceit, but I believe that the term just doesn't describe the approach used well which spans so many different methodologies and concepts. (to throw some keywords out there: TDD, Agile, idioms, patterns) To say that developers merely write code is like calling engineers builders or doctors healers. (again, those terms wouldn't be wrong, but quite reductive) Writing code isn't hard at all. I could teach someone how to write working hello world programs in a day. The hard part is architecting these projects to be readable, modular, extensible, efficient, and to follow standards.
      - eropple 10y ago
        Also not the OP, but this is exactly why I don't use the term except in a pejorative sense. Code is a tool in my toolbox; it is not what I do, it is what I may apply to a problem if it is appropriate to do so. If I describe someone as a coder, it's because I don't particularly trust them to solve problems that don't involve code (and I probably don't trust them to solve problems that do, either).
clarkenheim 10y ago
Thinly veiled publicity stunt by the Department of Defence here.
- sleepychu 10y ago
  Can you elaborate? What's your proposed motive for a publicity stunt?
  - schindlabua 10y ago
    I disagree with the OP but that's a bit of a non-question. I was under the impression that the motive for any sort of publicity stunt is trying to gain publicity..
    - sleepychu 10y ago
      Yeah sure, and what's the purpose of that for a federal organisation as prevalent as the military?
      - clarkenheim 10y ago
        Trying to portray a message of transparency after few years ago being exposed by Snowden for running a non constitutional spying program on all US (and non US) citizens. I thought the motive for positive publicity from the DoD since that happened would be pretty obvious.
        wslack 10y ago
        You can look up the people involved using GitHub. A desire for positive publicity doesn't invalidate anything good an org does.
  - deleted 10y ago
    [deleted]
imroot 10y ago
It'll be interesting to see the intersection of this and forge.mil (which was/is the DoD's implementation of SourceForge and associated services). About 5 years ago, there was a fair amount of Open Source Software being ran in DISA for supporting the branches and the software that they wrote, but, there was little open-sourcing of that software, even amongst the individual branches of service (the Marines might write something that the Army could use, but, there were political or other factors that precluded that from happening).
- tomberek 10y ago
  Re-inventing the wheel is still rampant. This effort, along with open sourcing the work of contractors, may provide a venue for increased sharing. Please let us know your thoughts. (Note: employee of DDS)
rectang 10y ago
The NSA open sourced what became Apache Accumulo years ago, so that government org has made peace with the copyright issue. The DoD, though, is still trying to feel its way around. There seem to be some lawyers there who are very hard to convince. For years, they've been asking to have various licenses and CLAs modified and we've been telling them no. Here's their latest request for the Apache License 2.1: http://markmail.org/message/eueu4rzlbpe2ugcj http://markmail.org/message/eueu4rzlbpe2ugcj
- konklone 10y ago
  Just so it's clear, NSA is technically part of DoD. (Though it's a bit like FBI's relation to DOJ, they operate very independently.) Also, the DoD CIO has had, since ~2003, this excellent FAQ supporting open source: http://dodcio.defense.gov/Open-Source-Software-FAQ/ http://dodcio.defense.gov/Open-Source-Software-FAQ/ But as people on this thread and elsewhere will tell you, that hasn't resulted in widespread support at DoD for open source.
- deleted 10y ago
  [deleted]
- jcurbo 10y ago
  As discussed elsewhere in this thread, acceptance of open source is very much an agency-by-agency deal within the DoD. IC orgs have pretty wide latitude to do what they want and NSA even more than others because of the primacy of their mission. Accumulo is widely used within the IC so it was to NSA's advantage to let it out - no doubt they did not want to maintain it themselves. Many orgs don't want to take on the burden of maintaining something, especially in the current budget climate where they'll have to go fight for $$$ and probably drop some other mission to make room.
xemdetia 10y ago
Am I missing something here or is there nothing associated with this initiative other than 'please check our LICENSE agreement?'
- sfifs 10y ago
  There IS a license agreement. Perhaps you didn't click the right link?
- aniers 10y ago
  It says the first projects will be released once the license agreement is finalized, so at the end of March.
engi_nerd 10y ago
This is a huge battle I am in the middle of fighting right now. I am working on a project that is extremely late and we are having all kinds of political pressure put on us by very senior people. Meanwhile their damn IA staff won't approve any of the tools or hardware that I need to help us get the job done. One huge obstacle to open-source anything in DoD is the attitudes of their information assurance professionals. I have been told by numerous DoD IA people that "Open Source is bad because anyone can put anything in it" and "We'd rather have someone to call." I understand the second point -- we honestly don't have the time to run every last issue to ground and it's probably better if we do have some professional support for some of our most important tools. But the first just boggles my mind. But the IA pros are, as a group, schizophrenic, because somehow people are getting things by them anyway. The system I'm working on has Python as a build dependency. The devs are creating reports using Jupyter notebooks. Basically the DoD needs to stop being so damn obstinate about open source.
- kls 10y ago
  STIGS say that if it is open source and unencumbered by contract support requirements that it is fair game. Use IA's own hammer against them. It's right in the AppDev STIG.
  - euroclydon 10y ago
    There must be a further vetting process beside whether or not an open source library has contract support requirements. Otherwise GOV developers could just pull some Chinese student's OSS encryption library for their next VPN project... Oh wait, there's FIPS. This blanket statement you've made isn't very meaningful.
- panzagl 10y ago
  IA is there to tell you no. You have to make the case to the aquisition organization and the end user that not using the tool is a greater risk to the mission than using the tool. And remember what you're developing may outlast your career- maintenance and sustainability are much bigger issues to the DoD than any discomfort caused to the developer, even if it means schedule slip. And for what it's worth, open source has been used pretty widely on the projects I've worked on- there's risk being tied to a single vendor and most acquisition orgs get that. The rare cases where we couldn't use O/S were usually situations where someone was trying to do something on Windows machines and they were trying to fly under IA's radar.
rkeene2 10y ago
There's also forge.mil, which has existed for a while but requires a TLS client certificate to access.
- dwheeler 10y ago
  Forge.mil is NOT useful for open source software projects. If you're developing OSS, it'd make more sense to use a public site designed for the purpose like GitHub or GitLab or (yes even) SourceForge. Forge.mil is more for non-OSS projects that cannot use the usual public sites. Forge.mil is based on the old version of the SourceForge software. The public documents say it uses Subversion, for example - there's no hint that forge.mil supports git: http://www.forge.mil/Faqs.html http://www.forge.mil/Faqs.html .
brudgers 10y ago
BRL-CAD has been an open source US Department of Defense project for many years. It is architected with the *NIX philosophy of chaining small single purpose tools...The exception that proves the rule? It's own version of Emacs. It highlights a unique aspect of Federal Government developed software: it's public domain rather than licensed based on copyright law. This facilitates reuse but complicates contribution by outside developers. https://brlcad.org/ https://brlcad.org/ https://brlcad.org/d/about https://brlcad.org/d/about
- walterbell 10y ago
  Copyright may still apply outside the US, no?
  - brudgers 10y ago
    [IANAL]
- fnordfnordfnord 10y ago
  and also ping by the same author https://en.wikipedia.org/wiki/Mike_Muuss https://en.wikipedia.org/wiki/Mike_Muuss
magicmu 10y ago
On one hand it's always cool to see increased adoption of open source, but it strikes me as more than a little subversive for the DoD to adopt an open source methodology. I can't help but see the appropriation of an inherently equitable and socialist means of sharing innovation (FOSS) by a violent, exclusionary, and globally oppressive regime to be a step in a very wrong direction.
- fauigerzigerk 10y ago
  I get the "violent, exclusionary, and globally oppressive" part, but why "socialist"? Open source strikes me as rather ideology neutral. If anything it's perhaps a bit anarchic. Socialism is all about reducing the effect that direct actions and agreements between individuals can have on society as a whole. Open source is all about direct action and the unplanned dynamics that may unfold as a result.
  - magicmu 10y ago
    That's an interesting definition of socialism; I didn't intend it in that way. Open source seems "socialist" to me by virtue of the pretty much the same attributes that you're (I think correctly) describing as anarchic. It's a broad term, I think we're saying the same thing :)
  - niels_olson 10y ago
    I believe socialism has a pretty specific definition: government ownership and control of the means of production. Which is easy to grasp for steel mills, power plants, and hospitals. A bit trickier in the creative economy and the gig economy.
    - fauigerzigerk 10y ago
      I am aware of the definition and I don't dispute it. But consider for a moment why socialism wants the state to own all means of production. The point is to directly control the effects of economically relevant actions and not leave it to an emergent dynamic that results from direct actions and agreements between individuals (i.e. the invisible hand). Socialists think that it is in everyone's best interest if the government plans what work needs to be done, what resources to allocate and under what conditions the product should be made available to users, which directly contradicts the way in which open source software is produced. In my view, the similarities between the DoD and socialism are lot greater than the similarities between open source and socialism. Any particular open source project can of course adopt a military style command and control structure, but not the open source model as a whole.
deleted 10y ago
[deleted]
_lex 10y ago
It sounds like there's a space for a company that simply validates these issues and supports opensource software, for customers like DOD. I'd expect that such a company could charge each customer quite a bit, and that each customer will want pretty much the same verification of the same libraries, with additional work only needed as new stuff gets requested. Thoughts?
- low_key 10y ago
  There are some of these that exist already. None that I'm aware of are very large. I've even seen one that was operated by the contractor that needed to have to open source software approved for use in another project.
lloydde 10y ago
No one wants yet another license. Is there an explanation about why Unlicense is not appropriate? Or what it would take for an Unlicense derivative to meet the legal requirements? Could the laws be changed in small ways to allow US Government employees to more fully participate in open source? "The Unlicense is a template for disclaiming copyright monopoly interest in software you've written; in other words, it is a template for dedicating your software to the public domain. It combines a copyright waiver patterned after the very successful public domain SQLite project with the no-warranty statement from the widely-used MIT/X11 license." http://unlicense.org/ http://unlicense.org/ I like how other commenters have included other successfully US.gov and specifically DoD open source such as BRL-CAD and NSA's Apache Accumulo. And the DoD Open Source FAQ is interesting and something I haven't seen before: http://dodcio.defense.gov/Open-Source-Software-FAQ/ http://dodcio.defense.gov/Open-Source-Software-FAQ/ Open source and US.gov participation reminds me of what happened with NASA Nova. It was pretty sad that when OpenStack became relevant in the industry that seemed to cause a panic at NASA and they pulled completely out of OpenStack development. Instead of NASA being to help the project stay focused on being opinionated enough to be generally useful (out of the box), NASA was too afraid about the perception of competing with proprietary commercial interests. (It was nice to see last year, all these years later, that NASA’s Jet Propulsion Laboratory is now a user again having purchased RedHat OpenStack.)
- rectang 10y ago
  > Is there an explanation about why Unlicense is not appropriate? The Unlicense was not drafted by legal professionals. Please do not use. https://lists.opensource.org/pipermail/license-review/2012-January/001381.html https://lists.opensource.org/pipermail/license-review/2012-J... CC0 is better. However, it still has issues in that it explicitly disclaims patent grants. We still don't have a solid license of this class.
  - lloydde 10y ago
    Thanks for that link. https://lists.opensource.org/pipermail/license-review/2012-January/001386.html https://lists.opensource.org/pipermail/license-review/2012-J... provided more details. Has the Open Source Initiative otherwise tried to find a solution such that software works of the United States government would have a clean path to be compatible with Open Source? CC0 may be better if you are looking for international agreement, though it seems like the patent related clause resulted in the review by opensource.org to be abandoned. "CC0 was not explicitly rejected, but the License Review Committee was unable to reach consensus that it should be approved, and Creative Commons eventually withdrew the application. The most serious of the concerns raised had to do with the effects of clause 4(a), which reads: "No ... patent rights held by Affirmer are waived, abandoned, surrendered, licensed or otherwise affected by this document.". While many open source licenses simply do not mention patents, it is exceedingly rare for open source licenses to explicitly disclaim any conveyance of patent rights, and the Committee felt that approving such a license would set a dangerous precedent, and possibly even weaken patent infringement defenses available to users of software released under CC0." https://opensource.org/faq#cc-zero https://opensource.org/faq#cc-zero
wyldfire 10y ago
> This can make it hard to attach an open source license to our code. It's not clear to me why this is necessary/desired. Is it because of contribution to existing works protected by copyright or something else? From the OSI's FAQ [1]: > What about software in the "public domain"? Is that Open Source? > There are certain circumstances, such as with U.S. government works ... we think it is accurate to say that such software is effectively open source, or open source for most practical purposes What problem does this license aim to solve? [1] https://opensource.org/faq#public-domain https://opensource.org/faq#public-domain EDIT: ok this comment [2] clears things up a bit. AFAICT It's specifically regarding a mechanism to permit foreign contributors while allowing them to disclaim liability. [2] https://github.com/deptofdefense/code.mil/issues/14#issuecomment-282310303 https://github.com/deptofdefense/code.mil/issues/14#issuecom...
austincheney 10y ago
Speaking as a long time US soldier here is how the military perceives code: * There is no copyright and plagiarism doesn't exist. Internally to the military everything is libre to the most maximum extreme. While people do get credit for their work they have no control over that work and anybody else in the military can use their work without permission. * Service members and employees of the military are not allowed to sue the military. As a result software written by the military has no need to disclaim a warranty or protect itself from other civil actions. * Information Assurance protections are draconian. This is half way valid in that there are good monitoring capabilities and military information operations are constantly under attack like you couldn't imagine. The military gets criminal and script-kiddie attacks just like everybody else, but they also get sophisticated multi-paradigm attacks from nation states. Everything is always locked down all the time. This makes using any open source software really hard unless it is written yourself or you work for some advanced cyber security organization.
- webmaven 10y ago
  > The military gets criminal and script-kiddie attacks just like everybody else, but they also get sophisticated multi-paradigm attacks from nation states. Just like everybody else.
  - 67726e 10y ago
    I work for a company in the cyber-crime / cyber-security space. We piss off criminals. We get attacked. We'll still never see half the shit the USG does, we'll still never see half the shit a Google or Facebook does. Stop pretending your "Facebook for Cats" company is going to experience the same level of threat. It's foolish and sounds egotistical to pretend someone cares that fucking much.
    - webmaven 10y ago
      I only meant that the private sector (eg. GOOG, FB, etc.) are constantly dealing with APTs as well, it isn't just the USG. That said, I think you're on to something there, and I am immediately launching[1] my new Facebook-for-Cats venture! Wish me luck! [0] Nah...[2] [1] Tentatively named either FurrBook or PurrBook[0] [2] Well, maybe... [0]
rmc 10y ago
Wonder if they will have a code of conduct.... :P
zo7 10y ago
My only bit of experience working on a DoD-related project was a huge turn-off for me to do any more work in that space in the future because they were resistive about approving any open source software. The development mindset on the project was to re-implement everything (including some tricky algorithms we were using) because it was unreasonable to expect any timely approval, even if it's a feature from the current version of a library that was already approved for an older version. I don't see the reasoning with it, since if anything open source is more secure because you know exactly what is going on inside of it, compared to closed source which may be from a trusted source but you have no idea what it's really doing under the hood. Hopefully this helps push things in the right direction, although I'm not optimistic.
brilliantcode 10y ago
Not only is helping the defense industry downright immoral, it's a waste of talent. Just think back to why you studied computer science or coding. I hope it wasn't to help build spy tools on your friends & families. I hope it wasn't to help engineer destructive weapons that is dropped on innocent civilians. Fuck code.mil, fuck lockheed martin. edit: I've turned down VC money a while ago because I discovered they had previously sold a company to Lockheed Martin affiliate. Downvote all you want but I'm not some spinless piece of shit that will throw out principles and morals for it. I love making money but it's not worth losing your compass or soul over.
- deleted 10y ago
  [deleted]
- mindcrime 10y ago
  I'm sorry you've been downvoted so heavily. FWIW, I am very sympathetic to your position. So much so that when In-Q-Tel came knocking a couple of years ago, wanting to talk to us about potential funding, we didn't even bother returning their call. And then I published a public op-ed explaining why we had no interest in working with the Defense/Intelligence/Spook complex. Like you said, there's more at stake than money.
  - brilliantcode 10y ago
    I like the cut of your jib. Good to know there's still individuals out there with actual standards and strong moral ground. The defense industry is dirty business. They are in the business of hurting, killing, and causing suffering. I really can't believe he level of support HN is showing. Yesterday's thread and comments about Peter Thiel about being a POS & hypocrite for Palantir. Today, open support of defense industry is front page.
    - gabesullice 10y ago
      Senseless violence is and everywhere should be condemned, but violence itself is not inherently a wrong. The violent actions of the US and Allied forces brought an end to the Holocaust. Violence is sometimes necessary and morally just in self defense and in defense of those who cannot defend themselves. Would you claim that the work of US Coast Guard after Hurricane Katrina was immoral? Is the Coast Guard "in the business of hurting, killing, and causing suffering"? The "support" you see here on HN has less to do with hypocrisy, but instead is condemning your ill-reasoned moral absolutism.
lewiscollard 10y ago
> Usually when someone attaches an open source license to their work, they’re licensing their copyright in that work to others. U.S. Federal government employees generally don’t have copyright under U.S. and some international law for work they create as part of their jobs. In those places, we base our open source license in contract—rather than copyright—law. > ... > When You copy, contribute to, or use this Work, You are agreeing to the terms and conditions in this Agreement and the License. I do not see how this is enforceable, or that it even makes sense, any more than it would make sense for me to take, say, a NASA photo and slap my own terms on it. If it's in the public domain, there's no ownership and no 'or else' to back a contract setting licensing terms. The alternative is that I'm misunderstanding this license, of course. Where am I going wrong?
deleted 10y ago
[deleted]
cosinetau 10y ago
I did a senior research project with a DoD contractor at my university in my last semester. It was a lot of fun, and we got to get exposed to a handful of tools and practices these parties use. I'm very excited at the prospect that maybe some of them will become free. Kudos DoD!
23443463453 10y ago
Am I overlooking it or is there no source or attribution of this effort? Who in the DoD is supposedly working on this? There is really nothing preventing DoD from using existing licenses. I'm not even sure I understand why this is even necessary, nor does it seem they are margin the case for the need.
noobermin 10y ago
It makes a lot of sense for Gov't funded IP to not have a copyright attached to it. I feel similarly for gov't funded research. Of course, this doesn't include things that should be export controlled for national security reasons.

378 points by us0r 10y ago

kogus 10y ago

I have never worked on code intended for military use. From my layman's point of view, it seems like DoD code would either be "the most boring legacy CMS you can imagine" or "top secret missile guidance AI systems". The former isn't interesting. The latter should probably stay closed-source. Is there any DoD code that is both interesting and suitable for public consumption?

detaro 10y ago
Infrastructure stuff? e.g. SELinux was created by the NSA.
krylon 10y ago
NB I have no first-hand knowledge, hence being deliberately vague. But I remember reading about a statement from the Pentagon that they recouped every cent they ever invested in computer science research during Operation Desert Storm, thanks to a logistics package that had grown out of said research. And given the scope of the US military apparatus, it does not sound ridiculous. Now, this is like 4th-level hearsay, but I can imagine such a logistics package would be quite interesting for many a company.
astine 10y ago
I don't work on any DoD stuff myself, but folks I know have developed ad-hoc networking capabilities that are mainly useful for helping military units communicate but likely have other applications.
jcurbo 10y ago
It is surprising to people outside the DoD, but most applications are exceedingly mundane - I would lump a lot of them under "database frontends," like personnel, finance, and logistics systems. One problem there is that, in many cases, DoD or its contractors end up writing custom code for those things rather than using existing solutions, so projects get delayed as feature creep sets in. There is a bigger push for using commodity software but it's slow in coming. For things where you truly need custom code - like missile guidance systems, avionics, specific process oriented tools for crunching data (intel or otherwise), open sourcing the core application is probably not going to help anyway. One problem though is that, increasingly, people want to use open source libraries for things. Take the data crunching - people want to use R, Python, Hadoop, whatever. This is where people are running into issues. And good luck getting those tools into close environments (e.g. classified networks) - many places do not have the resources in manpower or expertise to custom build the environments they need, so they couldn't use the newest shiny stuff even if they wanted to, even if their IA shop allowed it. As to your last question, not a lot of examples to mind (maybe Accumulo like someone mentioned elsewhere), but another factor is that there are few programmers that are actually DoD civil servants - most stuff is written by contractors and DoD folks don't usually have the experience or knowledge necessary to even understand what they're getting at a technical level in order to recognize that what they have is something worth open sourcing (which might take some work). I'm not saying it's bad everywhere - I have met some pretty awesome technical folks that were GS's - but it's very uneven. (disclaimer: USAF vet and still involved with the DoD)

ryanmaynard 10y ago

It appears some of the 18F crew are behind this. I'm interested to see what unfolds in this repo.

dkhenry 10y ago
Actually it would appear to be the Defense Digital Service https://www.dds.mil/ The contact in the license points to a dds.mil address
- ryanmaynard 10y ago
  Forgive my ignorance. I thought 18F and Digital Services were interlinked.
  - konklone 10y ago
    I'm from 18F, and I'm now a "contributor", but only because they accepted my pull requests. :)
  - webmaven 10y ago
    The Defense Digital Service and the US Digital Service are distinct organizations: http://www.defenseone.com/technology/2015/11/meet-head-pentagons-agile-new-digital-service/123825/ http://www.defenseone.com/technology/2015/11/meet-head-penta...
  - Readywater 10y ago
    DDS spun out of US Digital Service and DDS members go through the USDS hiring pipeline. 18F, USDS, and the Presidential Innovation Fellowships are philosophically related, but organizationally and functionally distinct.

dkhenry 10y ago

I love seeing this kind of work done. Not because its going to radically change the underlying technology, but having the air cover a project like this will provide can enable so many government coders who get shut down by their first tier manager who tells them they can't use open source components or can't open source their code. Its might seem silly but just getting the projects out in the open increases their hygiene more then any other single factor.

michaelvoz 10y ago
I hate the word coders. Lets stop using it
- qz_ 10y ago
  Why? It's pretty descriptive.
  - cooper12 10y ago
    Personally, and I'd like to stress that this is my opinion, I feel that the term is very reductive. It has its etymology in "code", when programming encompasses much more than just writing code. (we also write documentation, tests, use complex tools, version control, invoke the command line, etc...) It evokes the term "code monkey" which just sees programmers as tools to barf out code. Lastly this is just my own conceit, but I believe that the term just doesn't describe the approach used well which spans so many different methodologies and concepts. (to throw some keywords out there: TDD, Agile, idioms, patterns) To say that developers merely write code is like calling engineers builders or doctors healers. (again, those terms wouldn't be wrong, but quite reductive) Writing code isn't hard at all. I could teach someone how to write working hello world programs in a day. The hard part is architecting these projects to be readable, modular, extensible, efficient, and to follow standards.
    - eropple 10y ago
      Also not the OP, but this is exactly why I don't use the term except in a pejorative sense. Code is a tool in my toolbox; it is not what I do, it is what I may apply to a problem if it is appropriate to do so. If I describe someone as a coder, it's because I don't particularly trust them to solve problems that don't involve code (and I probably don't trust them to solve problems that do, either).

clarkenheim 10y ago

Thinly veiled publicity stunt by the Department of Defence here.

sleepychu 10y ago
Can you elaborate? What's your proposed motive for a publicity stunt?
- schindlabua 10y ago
  I disagree with the OP but that's a bit of a non-question. I was under the impression that the motive for any sort of publicity stunt is trying to gain publicity..
  - sleepychu 10y ago
    Yeah sure, and what's the purpose of that for a federal organisation as prevalent as the military?
    - clarkenheim 10y ago
      Trying to portray a message of transparency after few years ago being exposed by Snowden for running a non constitutional spying program on all US (and non US) citizens. I thought the motive for positive publicity from the DoD since that happened would be pretty obvious.
      - wslack 10y ago
        You can look up the people involved using GitHub. A desire for positive publicity doesn't invalidate anything good an org does.
- deleted 10y ago
  [deleted]

imroot 10y ago

It'll be interesting to see the intersection of this and forge.mil (which was/is the DoD's implementation of SourceForge and associated services). About 5 years ago, there was a fair amount of Open Source Software being ran in DISA for supporting the branches and the software that they wrote, but, there was little open-sourcing of that software, even amongst the individual branches of service (the Marines might write something that the Army could use, but, there were political or other factors that precluded that from happening).

tomberek 10y ago
Re-inventing the wheel is still rampant. This effort, along with open sourcing the work of contractors, may provide a venue for increased sharing. Please let us know your thoughts. (Note: employee of DDS)

rectang 10y ago

The NSA open sourced what became Apache Accumulo years ago, so that government org has made peace with the copyright issue. The DoD, though, is still trying to feel its way around. There seem to be some lawyers there who are very hard to convince. For years, they've been asking to have various licenses and CLAs modified and we've been telling them no. Here's their latest request for the Apache License 2.1: http://markmail.org/message/eueu4rzlbpe2ugcj http://markmail.org/message/eueu4rzlbpe2ugcj

konklone 10y ago
Just so it's clear, NSA is technically part of DoD. (Though it's a bit like FBI's relation to DOJ, they operate very independently.) Also, the DoD CIO has had, since ~2003, this excellent FAQ supporting open source: http://dodcio.defense.gov/Open-Source-Software-FAQ/ http://dodcio.defense.gov/Open-Source-Software-FAQ/ But as people on this thread and elsewhere will tell you, that hasn't resulted in widespread support at DoD for open source.
deleted 10y ago
[deleted]
jcurbo 10y ago
As discussed elsewhere in this thread, acceptance of open source is very much an agency-by-agency deal within the DoD. IC orgs have pretty wide latitude to do what they want and NSA even more than others because of the primacy of their mission. Accumulo is widely used within the IC so it was to NSA's advantage to let it out - no doubt they did not want to maintain it themselves. Many orgs don't want to take on the burden of maintaining something, especially in the current budget climate where they'll have to go fight for $$$ and probably drop some other mission to make room.

xemdetia 10y ago

Am I missing something here or is there nothing associated with this initiative other than 'please check our LICENSE agreement?'

sfifs 10y ago
There IS a license agreement. Perhaps you didn't click the right link?
aniers 10y ago
It says the first projects will be released once the license agreement is finalized, so at the end of March.

engi_nerd 10y ago

This is a huge battle I am in the middle of fighting right now. I am working on a project that is extremely late and we are having all kinds of political pressure put on us by very senior people. Meanwhile their damn IA staff won't approve any of the tools or hardware that I need to help us get the job done. One huge obstacle to open-source anything in DoD is the attitudes of their information assurance professionals. I have been told by numerous DoD IA people that "Open Source is bad because anyone can put anything in it" and "We'd rather have someone to call." I understand the second point -- we honestly don't have the time to run every last issue to ground and it's probably better if we do have some professional support for some of our most important tools. But the first just boggles my mind. But the IA pros are, as a group, schizophrenic, because somehow people are getting things by them anyway. The system I'm working on has Python as a build dependency. The devs are creating reports using Jupyter notebooks. Basically the DoD needs to stop being so damn obstinate about open source.

kls 10y ago
STIGS say that if it is open source and unencumbered by contract support requirements that it is fair game. Use IA's own hammer against them. It's right in the AppDev STIG.
- euroclydon 10y ago
  There must be a further vetting process beside whether or not an open source library has contract support requirements. Otherwise GOV developers could just pull some Chinese student's OSS encryption library for their next VPN project... Oh wait, there's FIPS. This blanket statement you've made isn't very meaningful.
panzagl 10y ago
IA is there to tell you no. You have to make the case to the aquisition organization and the end user that not using the tool is a greater risk to the mission than using the tool. And remember what you're developing may outlast your career- maintenance and sustainability are much bigger issues to the DoD than any discomfort caused to the developer, even if it means schedule slip. And for what it's worth, open source has been used pretty widely on the projects I've worked on- there's risk being tied to a single vendor and most acquisition orgs get that. The rare cases where we couldn't use O/S were usually situations where someone was trying to do something on Windows machines and they were trying to fly under IA's radar.

rkeene2 10y ago

There's also forge.mil, which has existed for a while but requires a TLS client certificate to access.

dwheeler 10y ago
Forge.mil is NOT useful for open source software projects. If you're developing OSS, it'd make more sense to use a public site designed for the purpose like GitHub or GitLab or (yes even) SourceForge. Forge.mil is more for non-OSS projects that cannot use the usual public sites. Forge.mil is based on the old version of the SourceForge software. The public documents say it uses Subversion, for example - there's no hint that forge.mil supports git: http://www.forge.mil/Faqs.html http://www.forge.mil/Faqs.html .

brudgers 10y ago

BRL-CAD has been an open source US Department of Defense project for many years. It is architected with the *NIX philosophy of chaining small single purpose tools...The exception that proves the rule? It's own version of Emacs. It highlights a unique aspect of Federal Government developed software: it's public domain rather than licensed based on copyright law. This facilitates reuse but complicates contribution by outside developers. https://brlcad.org/ https://brlcad.org/ https://brlcad.org/d/about https://brlcad.org/d/about

walterbell 10y ago
Copyright may still apply outside the US, no?
- brudgers 10y ago
  [IANAL]
fnordfnordfnord 10y ago
and also ping by the same author https://en.wikipedia.org/wiki/Mike_Muuss https://en.wikipedia.org/wiki/Mike_Muuss

magicmu 10y ago

On one hand it's always cool to see increased adoption of open source, but it strikes me as more than a little subversive for the DoD to adopt an open source methodology. I can't help but see the appropriation of an inherently equitable and socialist means of sharing innovation (FOSS) by a violent, exclusionary, and globally oppressive regime to be a step in a very wrong direction.

fauigerzigerk 10y ago
I get the "violent, exclusionary, and globally oppressive" part, but why "socialist"? Open source strikes me as rather ideology neutral. If anything it's perhaps a bit anarchic. Socialism is all about reducing the effect that direct actions and agreements between individuals can have on society as a whole. Open source is all about direct action and the unplanned dynamics that may unfold as a result.
- magicmu 10y ago
  That's an interesting definition of socialism; I didn't intend it in that way. Open source seems "socialist" to me by virtue of the pretty much the same attributes that you're (I think correctly) describing as anarchic. It's a broad term, I think we're saying the same thing :)
- niels_olson 10y ago
  I believe socialism has a pretty specific definition: government ownership and control of the means of production. Which is easy to grasp for steel mills, power plants, and hospitals. A bit trickier in the creative economy and the gig economy.
  - fauigerzigerk 10y ago
    I am aware of the definition and I don't dispute it. But consider for a moment why socialism wants the state to own all means of production. The point is to directly control the effects of economically relevant actions and not leave it to an emergent dynamic that results from direct actions and agreements between individuals (i.e. the invisible hand). Socialists think that it is in everyone's best interest if the government plans what work needs to be done, what resources to allocate and under what conditions the product should be made available to users, which directly contradicts the way in which open source software is produced. In my view, the similarities between the DoD and socialism are lot greater than the similarities between open source and socialism. Any particular open source project can of course adopt a military style command and control structure, but not the open source model as a whole.

deleted 10y ago

[deleted]

_lex 10y ago

It sounds like there's a space for a company that simply validates these issues and supports opensource software, for customers like DOD. I'd expect that such a company could charge each customer quite a bit, and that each customer will want pretty much the same verification of the same libraries, with additional work only needed as new stuff gets requested. Thoughts?

low_key 10y ago
There are some of these that exist already. None that I'm aware of are very large. I've even seen one that was operated by the contractor that needed to have to open source software approved for use in another project.

lloydde 10y ago

No one wants yet another license. Is there an explanation about why Unlicense is not appropriate? Or what it would take for an Unlicense derivative to meet the legal requirements? Could the laws be changed in small ways to allow US Government employees to more fully participate in open source? "The Unlicense is a template for disclaiming copyright monopoly interest in software you've written; in other words, it is a template for dedicating your software to the public domain. It combines a copyright waiver patterned after the very successful public domain SQLite project with the no-warranty statement from the widely-used MIT/X11 license." http://unlicense.org/ http://unlicense.org/ I like how other commenters have included other successfully US.gov and specifically DoD open source such as BRL-CAD and NSA's Apache Accumulo. And the DoD Open Source FAQ is interesting and something I haven't seen before: http://dodcio.defense.gov/Open-Source-Software-FAQ/ http://dodcio.defense.gov/Open-Source-Software-FAQ/ Open source and US.gov participation reminds me of what happened with NASA Nova. It was pretty sad that when OpenStack became relevant in the industry that seemed to cause a panic at NASA and they pulled completely out of OpenStack development. Instead of NASA being to help the project stay focused on being opinionated enough to be generally useful (out of the box), NASA was too afraid about the perception of competing with proprietary commercial interests. (It was nice to see last year, all these years later, that NASA’s Jet Propulsion Laboratory is now a user again having purchased RedHat OpenStack.)

rectang 10y ago
> Is there an explanation about why Unlicense is not appropriate? The Unlicense was not drafted by legal professionals. Please do not use. https://lists.opensource.org/pipermail/license-review/2012-January/001381.html https://lists.opensource.org/pipermail/license-review/2012-J... CC0 is better. However, it still has issues in that it explicitly disclaims patent grants. We still don't have a solid license of this class.
- lloydde 10y ago
  Thanks for that link. https://lists.opensource.org/pipermail/license-review/2012-January/001386.html https://lists.opensource.org/pipermail/license-review/2012-J... provided more details. Has the Open Source Initiative otherwise tried to find a solution such that software works of the United States government would have a clean path to be compatible with Open Source? CC0 may be better if you are looking for international agreement, though it seems like the patent related clause resulted in the review by opensource.org to be abandoned. "CC0 was not explicitly rejected, but the License Review Committee was unable to reach consensus that it should be approved, and Creative Commons eventually withdrew the application. The most serious of the concerns raised had to do with the effects of clause 4(a), which reads: "No ... patent rights held by Affirmer are waived, abandoned, surrendered, licensed or otherwise affected by this document.". While many open source licenses simply do not mention patents, it is exceedingly rare for open source licenses to explicitly disclaim any conveyance of patent rights, and the Committee felt that approving such a license would set a dangerous precedent, and possibly even weaken patent infringement defenses available to users of software released under CC0." https://opensource.org/faq#cc-zero https://opensource.org/faq#cc-zero

wyldfire 10y ago

> This can make it hard to attach an open source license to our code. It's not clear to me why this is necessary/desired. Is it because of contribution to existing works protected by copyright or something else? From the OSI's FAQ [1]: > What about software in the "public domain"? Is that Open Source? > There are certain circumstances, such as with U.S. government works ... we think it is accurate to say that such software is effectively open source, or open source for most practical purposes What problem does this license aim to solve? [1] https://opensource.org/faq#public-domain https://opensource.org/faq#public-domain EDIT: ok this comment [2] clears things up a bit. AFAICT It's specifically regarding a mechanism to permit foreign contributors while allowing them to disclaim liability. [2] https://github.com/deptofdefense/code.mil/issues/14#issuecomment-282310303 https://github.com/deptofdefense/code.mil/issues/14#issuecom...

austincheney 10y ago

Speaking as a long time US soldier here is how the military perceives code: * There is no copyright and plagiarism doesn't exist. Internally to the military everything is libre to the most maximum extreme. While people do get credit for their work they have no control over that work and anybody else in the military can use their work without permission. * Service members and employees of the military are not allowed to sue the military. As a result software written by the military has no need to disclaim a warranty or protect itself from other civil actions. * Information Assurance protections are draconian. This is half way valid in that there are good monitoring capabilities and military information operations are constantly under attack like you couldn't imagine. The military gets criminal and script-kiddie attacks just like everybody else, but they also get sophisticated multi-paradigm attacks from nation states. Everything is always locked down all the time. This makes using any open source software really hard unless it is written yourself or you work for some advanced cyber security organization.

webmaven 10y ago
> The military gets criminal and script-kiddie attacks just like everybody else, but they also get sophisticated multi-paradigm attacks from nation states. Just like everybody else.
- 67726e 10y ago
  I work for a company in the cyber-crime / cyber-security space. We piss off criminals. We get attacked. We'll still never see half the shit the USG does, we'll still never see half the shit a Google or Facebook does. Stop pretending your "Facebook for Cats" company is going to experience the same level of threat. It's foolish and sounds egotistical to pretend someone cares that fucking much.
  - webmaven 10y ago
    I only meant that the private sector (eg. GOOG, FB, etc.) are constantly dealing with APTs as well, it isn't just the USG. That said, I think you're on to something there, and I am immediately launching[1] my new Facebook-for-Cats venture! Wish me luck! [0] Nah...[2] [1] Tentatively named either FurrBook or PurrBook[0] [2] Well, maybe... [0]

rmc 10y ago

Wonder if they will have a code of conduct.... :P

zo7 10y ago

My only bit of experience working on a DoD-related project was a huge turn-off for me to do any more work in that space in the future because they were resistive about approving any open source software. The development mindset on the project was to re-implement everything (including some tricky algorithms we were using) because it was unreasonable to expect any timely approval, even if it's a feature from the current version of a library that was already approved for an older version. I don't see the reasoning with it, since if anything open source is more secure because you know exactly what is going on inside of it, compared to closed source which may be from a trusted source but you have no idea what it's really doing under the hood. Hopefully this helps push things in the right direction, although I'm not optimistic.

brilliantcode 10y ago

Not only is helping the defense industry downright immoral, it's a waste of talent. Just think back to why you studied computer science or coding. I hope it wasn't to help build spy tools on your friends & families. I hope it wasn't to help engineer destructive weapons that is dropped on innocent civilians. Fuck code.mil, fuck lockheed martin. edit: I've turned down VC money a while ago because I discovered they had previously sold a company to Lockheed Martin affiliate. Downvote all you want but I'm not some spinless piece of shit that will throw out principles and morals for it. I love making money but it's not worth losing your compass or soul over.

deleted 10y ago
[deleted]
mindcrime 10y ago
I'm sorry you've been downvoted so heavily. FWIW, I am very sympathetic to your position. So much so that when In-Q-Tel came knocking a couple of years ago, wanting to talk to us about potential funding, we didn't even bother returning their call. And then I published a public op-ed explaining why we had no interest in working with the Defense/Intelligence/Spook complex. Like you said, there's more at stake than money.
- brilliantcode 10y ago
  I like the cut of your jib. Good to know there's still individuals out there with actual standards and strong moral ground. The defense industry is dirty business. They are in the business of hurting, killing, and causing suffering. I really can't believe he level of support HN is showing. Yesterday's thread and comments about Peter Thiel about being a POS & hypocrite for Palantir. Today, open support of defense industry is front page.
  - gabesullice 10y ago
    Senseless violence is and everywhere should be condemned, but violence itself is not inherently a wrong. The violent actions of the US and Allied forces brought an end to the Holocaust. Violence is sometimes necessary and morally just in self defense and in defense of those who cannot defend themselves. Would you claim that the work of US Coast Guard after Hurricane Katrina was immoral? Is the Coast Guard "in the business of hurting, killing, and causing suffering"? The "support" you see here on HN has less to do with hypocrisy, but instead is condemning your ill-reasoned moral absolutism.

lewiscollard 10y ago

> Usually when someone attaches an open source license to their work, they’re licensing their copyright in that work to others. U.S. Federal government employees generally don’t have copyright under U.S. and some international law for work they create as part of their jobs. In those places, we base our open source license in contract—rather than copyright—law. > ... > When You copy, contribute to, or use this Work, You are agreeing to the terms and conditions in this Agreement and the License. I do not see how this is enforceable, or that it even makes sense, any more than it would make sense for me to take, say, a NASA photo and slap my own terms on it. If it's in the public domain, there's no ownership and no 'or else' to back a contract setting licensing terms. The alternative is that I'm misunderstanding this license, of course. Where am I going wrong?

deleted 10y ago

[deleted]

cosinetau 10y ago

I did a senior research project with a DoD contractor at my university in my last semester. It was a lot of fun, and we got to get exposed to a handful of tools and practices these parties use. I'm very excited at the prospect that maybe some of them will become free. Kudos DoD!

23443463453 10y ago

Am I overlooking it or is there no source or attribution of this effort? Who in the DoD is supposedly working on this? There is really nothing preventing DoD from using existing licenses. I'm not even sure I understand why this is even necessary, nor does it seem they are margin the case for the need.

noobermin 10y ago

It makes a lot of sense for Gov't funded IP to not have a copyright attached to it. I feel similarly for gov't funded research. Of course, this doesn't include things that should be export controlled for national security reasons.